IEEE Consumer Electronics Magazine - January/February 2024 - 32

Privacy-Aware Emerging Computing
detect outliers scattered across a sequence of
packets. However, predominant cognitive solutions
that detect runtime outliers deployed within
a CPS environment highly rely on the trained models
of conventional neural-network approaches,
thereby aiding cyber-offenders to bypass security
gateways of the critical infrastructure. In addition,
the intelligence simulated from a conventional
standalone model concern security researcher
about the generality-loss tradeoff since most conventional
models might also be modeled for
dynamic frameworks7 and exploitation tools that
cyber-attackers utilize for noxious purposes.
Thereby, stack generalization is gaining vast
insights from cyber-security researchers to overcome
such challenges. Thereby, persuaded this
entire research that presents the observations of
the stacked neural-network architecture proposed
and integrated with an open-source IDS for detecting
cyber threats in industrial control systems, outperforming
standalone deep-learning models in
detecting intrusions without false positives (FP).
STACKED DEEP-LEARNING MODEL
A stacked neural-network frameworkwith a pretrained
network ensemble of 5 feed-forward neural
nets, each containing 3 fully connected hidden
layers is proposed in this article to discriminate
threat events from the entire traffic capture with
reduced FP. Stacked ensemble architecture was
considered for modeling the proposed framework
in contrast to the standalone conventional deeplearning
architecture due to stack-generalization's8
performance boost over base learners proposed in
the literature by the machine-learning research
community. Stack generalization utilizes themodelaveraging
ensemble technique where the model
learns how to best ensemble the predictions contributed
by multiple pretrained base learners.
Hence, this article presents a model-averaging
(a special case of stacked generalization)-based
stacked framework to optimally identify cyber
threats on a CPS environment.
Architecture Implemented
This section provides configuration details of
each standalone neural nets that were ensembled
and employed for optimal threat detection. The
neural network modeled for this study
32
demonstrates the reliability of the neural-net stack,
where small changes in the network structure do
not degrade the overall detection capability. Kaiming
et al.'s9 notable observation that neural networks
with many hidden layers tend to enhance
the features presented and achieve improved proficiency
in unraveling real-time data patterns. However,
the detection efficiency of each neural
network is constrained by the data samples considered
for training each network ensembled
within the stack.
On the contrary, a denser network resulted in
data overfitting during initial prototyping. Upon
experimenting with multiple configurations, neural
net with a 3-layer configuration optimally discriminated
malicious samples from the samples
exhibiting normal traffic for both binary- and
multiclass labeled detection problems.
Neural nets configured with more than
3-layers did not generalize well for diversely sampled
classes and exhibited abnormal training loss
due to data overfitting. The hidden neuron configurations
prototyped for the fully connected neural
nets are: ð80; 60; 60Þ, ð80; 80; 60Þ, ð100; 80; 80Þ,
ð120; 100; 80Þ; and ð180; 120; 80Þ; respectively. It
was observed that network configuration with
rectified linear units (ReLUÞ and Softmax activation
functions performed better during initial
experimentations and were retained as activators
for the hidden and output layers, respectively.
Table 1 summarizes the neural-net model's overall
configuration, including the total number of
neurons and weights considered for each layer
during the training phase. The number of neurons
varies based on the network's structure and the
total number of samples imputed for each experimentation
trial. To avoid data overfitting, a
batch normalization layer and a dropout layer
has been included in the proposed architecture
sequentially for each densely connected layer.
Upon quantizing the common data vectors of the
predominant attack scenarios based on the
enhanced principal component analysis and
Kohonen-map ensemble,1 atotal of 19; 221 weights
were considered for the attack-detection case
study carried out over the industrial datasets. The
proposed network was coded in python programming
language by utilizing the Tensorflow ¼ 2:5:0
and Keras ¼ 2:4:3 packages, and experimented
with stochastic gradient descent ðSGDÞ optimizer
IEEE Consumer Electronics Magazine
IEEE Consumer Electronics Magazine - January/February 2024

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - January/February 2024
